The RSA NetWitness Platform has multiple new enhancements as to how it handles Lists and Feeds in v11.x. One of the enhancements introduced in the v11.1 release was the ability to use Context Hub Lists as Blacklist and/or Whitelist enrichment sources in ESA alerts. This feature allows analysts and administrators a much easier path to tuning and updating ESA alerts than was previously available.
In this post, I'll be explaining how you can take that one step further and create ESA alerts that automatically update Context Hub Lists that can in turn be used as blacklist/whitelist enrichment sources in other ESA alerts. The capabilities you'll use to accomplish this will be the ESA's script notifications, the ESA's Enrichment Sources and the Context Hub's List Data Source.
Your first step is to determine what kind of data you want to put into the Context Hub List. For my test case I chose source and destination IP addresses. Your next step is to determine where this List should live so that the Context Hub can access it. The Context Hub can pull Lists either via HTTP, HTTPS, or from its local file system on the ESA appliance - for my test case I chose the local filesystem.
With that decided, your next step is to create the file that will become the List - the Context Hub looks within the /var/netwitness/contexthub-server/data directory on the ESA, so you'll create a CSV file in this location and add headers to help you (and others) know what data the List contains:
**NOTE** Be sure to make this CSV writeable for all users, e.g.:
# chmod 666 esaList.csv
Next, add this CSV to the CH as a Data Source. In Admin / Services / Contexthub Server / Config --> Data Sources, choose List:
Select "Local File Store," then give your List a name and description and choose the CSV from the dropdown:
If you created headers in the CSV, select "With Column Headers" and then validate that the Context Hub can see and read your file. After validation is successful, tell the Context Hub what types of meta are in each column, whether to Append to or Overwrite values in the List when it updates, and also whether to automatically expire (delete) values once they reach a certain age (maximum value here is 30 days):
For my test case, I chose not to map the date_added and source_alert columns from the CSV to any meta keys, because I only want them for my own awareness to know where each value came from (i.e.: what ESA alert) and when it was added. Also, I chose to Append new values rather than Overwrite, because the Context Hub List has built in functionality that identifies new and unique values within the CSV and adds only those to the List. Append will also enable the List Value Expiration feature to automatically remove old values.
Once you have selected your options, save your settings to close the wizard. Before moving on, there are a few additional configuration options to point out which are accessible through the gear icon on the right side of the page. These settings will allow you to modify the existing meta mapping or add new ones, adjust the Expiration, enable or disable whether the List's values are loaded into cache, and most importantly - the List's update schedule, or Recurrence:
**NOTE** At the time of this writing, the Schedule Recurrence has a bug that causes the Context Hub to ignore any user-defined schedule, which means it will revert to the default setting and only automatically update every 12 hours.
With the Context Hub List created, you can move on to the script and notification template that you will use to auto-update the CSV (both are attached to this blog - you can upload/import them as is, or feel free to modify them however you like for your use cases / environment). You can refer to the documentation (System Configuration Guide for Version 11.x - Table of Contents) to add notification outputs, servers, and templates.
To test that all of this works and writes what you want to the CSV file (for my test case, IP source and destination values), create an ESA alert that will fire with the data points you want capture, and then add the script notification, server, and template to the alert:
After deploying your alert and generating the traffic (or waiting) for it to fire, verify that your CSV auto-updates with the values from the alert by keeping an eye on the CSV file. Additionally, you can force your Context Hub List to update by re-opening your List's settings (the gear icon mentioned above), re-saving your existing settings, and then checking its values within the Lists tab:
You'll notice that in my test case, my CSV file has 5 entries in it while my Context Hub List only has 3 - this is a result of the automatic de-duplication mentioned above; the List is only going to be Appending new and unique entries from the CSV.
Next up, add this List as an Enrichment Source to your ESA. Navigate to Configure / ESA Rules --> Setting tab / Enrichment Sources, and add a new Context Hub source:
In the wizard, select the List you created at the start of this process and the columns that you will want to use within ESA alerts:
With that complete, save and exit the wizard, and then move on to the last step - creating or modifying an ESA alert to use this Context Hub List as a whitelist or blacklist.
Unless your ESA alert requires advanced logic and functionality, you can use the ESA Rule Builder to create the alert. Within your alert statement, build out the alert logic and add a Meta Whitelist or Meta Blacklist Condition, depending on your use case:
Select the Context Hub List you just added as an Enrichment Source:
Select the column from the Context Hub List that you want to match against within your alert:
Lastly, select the NetWitness meta key that you want to match against it:
You can add additional Statements and additional blacklists or whitelists to your alert as your use case dictates. Once complete, save and deploy your alert, and then verify that your alerts are firing as expected:
And finally, give yourself a pat on the back.
11 Comments
